b06484457fac9078aff0b7daef89cbc30d155023313d172045775e28b67e7ebd | Triage

Analysis

max time kernel
21s
max time network
18s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
06/04/2024, 02:22

Sharing

Report Analysis Logs

General

Target

RunMePls‮gpj.exe
Size

13.6MB
MD5

bc5b47d8c43fa4fcb52876e92e796b42
SHA1

4ef1cbe3b6834af2080b06d379f43df7d898421d
SHA256

b06484457fac9078aff0b7daef89cbc30d155023313d172045775e28b67e7ebd
SHA512

00e89b63b0264235eb9f04dcee2cf75222fced4bcf6564aa4cbee9ff78e4bdc16497ad3b00cd16e7cbc2d442513e187aae6e286bbaef27554ea8c2f5d79d318d
SSDEEP

393216:orgbHdc3QjfclgA/BOWkDRrCYV4BHtW/BZo1:orgRcgrwOWXY8AZo

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1776	2152	WerFault.exe	28

Suspicious behavior: RenamesItself 5 IoCs

pid	Process
1400	RunMePls‮gpj.exe
1400	RunMePls‮gpj.exe
1400	RunMePls‮gpj.exe
2152	RunMePls.gpj.exe
2152	RunMePls.gpj.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1400 wrote to memory of 2152	1400	RunMePls‮gpj.exe	28
PID 1400 wrote to memory of 2152	1400	RunMePls‮gpj.exe	28
PID 1400 wrote to memory of 2152	1400	RunMePls‮gpj.exe	28
PID 1400 wrote to memory of 2152	1400	RunMePls‮gpj.exe	28
PID 2152 wrote to memory of 1776	2152	RunMePls.gpj.exe	29
PID 2152 wrote to memory of 1776	2152	RunMePls.gpj.exe	29
PID 2152 wrote to memory of 1776	2152	RunMePls.gpj.exe	29
PID 2152 wrote to memory of 1776	2152	RunMePls.gpj.exe	29

C:\Users\Admin\AppData\Local\Temp\RunMePls‮gpj.exe
"C:\Users\Admin\AppData\Local\Temp\RunMePls‮gpj.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1400
- C:\Users\Admin\AppData\Local\Temp\RunMePls.gpj.exe
  C:\Users\Admin\AppData\Local\Temp\RunMePls.gpj.exe
  2⤵
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:2152
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2152 -s 240
    3⤵
    - Program crash
    PID:1776

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1400-0-0x0000000000290000-0x0000000000296000-memory.dmp

Filesize
24KB

Download